14049 matches found
CVE-2026-14195 Brizy – Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info
The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts...
CVE-2026-14195
The Brizy WordPress plugin, in versions prior to 2.8.18 , contains an authorization bypass vulnerability. The flaw exists in a request handler that fails to properly verify permissions before returning post content. This allows users with a Contributor role or higher to access and read arbitrary ...
SUSE CVE-2026-58402
Hugo is a static site generator. From 0.60.0 until 0.163.3, Hugo's default code-block renderer wrote the Markdown code-fence language or info-string into the code class="language-..." data-lang="..." wrapper without HTML escaping. A fence info-string containing a quote and a script payload breaks...
Symlink Attack
Overview onionshare-cli is a software that lets you securely and anonymously send and receive files. It works by starting a web server, making it accessible as a Tor onion service, and generating an unguessable web address so others can download files from you, or upload files to you. It does not...
Exploit for CVE-2026-64531
OVSwrap CVE-2026-64531 Mitigation Tool A simple script that...
CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...
CVE-2026-15977 CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...
CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...
CVE-2026-15977
The SGLang framework (specifically versions >=0.1.26,
CVE-2026-15977 CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...
JLSEC-2026-832
ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager is mishandled in coders/jpeg.c...
JLSEC-2026-945 ImageMagick has NULL pointer dereference in ReadSFWImage after DestroyImageInfo (sfw.c)
In ReadSFWImage coders/sfw.c, when temporary file creation fails, readinfo is destroyed before its filename member is accessed, causing a NULL pointer dereference and crash. AddressSanitizer:DEADLYSIGNAL ================================================================= ==1414421==ERROR:...
JLSEC-2026-840
A call to ConformPixelInfo in the SetImageAlphaChannel routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-buffer-overflow READ when GetPixelRed or GetPixelBlue was called. This could occur if an attacker is able to submit a malicious image file to be processed by...
EUVD-2026-51178
Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue...
pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation
A flaw was found in pip. Prior to version 26.1, pip's self-update check functionality would execute after installing wheel packages. This process involved importing newly installed Python modules. A malicious actor could craft a specially designed wheel package that, when installed, could lead to...
CVE-2026-56847
A flaw in Node.js Permission Model enforcement allows traceevents.createTracing.enable Writes Trace Logs Outside --allow-fs-write. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js 22.x, 24.x, and...
PT-2026-66562
Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An issue exists where the '/server info' endpoint returns sensitive API keys and SSL keyfile information. This occurs specifically when only the --admin-api-key is configured. Recommendations ...
Oracle Linux 10 : kernel (ELSA-2026-45114)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-45114 advisory. - futex: Drop CLONETHREAD requirement for private default hash alloc Audra Mitchell RHEL-193518 CVE-2026-52973 - net: ipv6: fix NOREF dst use in seg6...
CVE-2026-64380
A flaw was found in the Linux kernel's Server Message Block SMB client. The vulnerability exists in the posixinfosidsize function, which is responsible for parsing POSIX Security Identifiers SIDs. An insufficient boundary check allows the system to accept truncated POSIX SIDs, which could lead to...
SUSE CVE-2026-64549
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10xsetup bpa10xsetup sends the vendor command 0xfc0e and passes the response to btdevinfo and hcisetfwinfo as a "%s" string starting at skb-data + 1, without checking the...